e192593ff1df7a3d24cc9463fdcde0b39b49a26816da608d50960da3131e2e36

Analysis

Target
Attachments_1.dll
Size 223KB
Sample211116-ng7e9adee7
SHA256 e192593ff1df7a3d24cc9463fdcde0b39b49a26816da608d50960da3131e2e36
MD5 869f280d62ffbc75bd140a75b01cf545
SHA1 bd224225099626d3af8e38915365f91f9f52d505
SHA512 e43a87e149d10afc43ad3127a23eff8ea0be2bb6104e355992a7c4949de1e2ce5a16ec1fae1ecf8ecbee238ab4803db3a5d8b0df934203c852a07d848307b85e
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
660	1084	WerFault.exe	26

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
660	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	660	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 660	1084	rundll32.exe	27
PID 1084 wrote to memory of 660	1084	rundll32.exe	27
PID 1084 wrote to memory of 660	1084	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Attachments_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1084 -s 88
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:660

memory/660-56-0x000007FEFBFE1000-0x000007FEFBFE3000-memory.dmp

Download

memory/660-57-0x0000000001CA0000-0x0000000001CA1000-memory.dmp

Download